How to Detect Rogue SIMATIC Time Synchronization Masters Using Wireshark

To detect unauthorized or rogue time synchronization masters transmitting SIMATIC-method time telegrams on the Plant Bus using Wireshark, capture traffic on a mirrored switch port and apply the display filter 'eth.dst == 09:00:06:01:ff:ef' or 'llc[0:2] == 0xfefe'. SIMATIC time synchronization operates at Layer 2 using standard Siemens multicast frames. Inspecting the Source MAC Address (eth.src) of captured time packets identifies the transmitting network card; comparing this MAC against HW Config isolates the rogue CPU, CP card, or workstation transmitting uncoordinated clock adjustments.

Layer 2 Frame Structure of the SIMATIC Time Synchronization Method

In SIMATIC PCS 7, time synchronization across the Industrial Ethernet Plant Bus can operate using either Network Time Protocol (NTP) at Layer 3/4 or the proprietary SIMATIC Mode at Layer 2:
* Protocol Architecture: SIMATIC mode utilizes raw ISO Industrial Ethernet multicast frames without IP encapsulation, bypassing IP routing overhead to achieve millisecond-level determinism.
* Multicast Destination Address: All SIMATIC time telegrams are broadcast to the reserved Siemens hardware multicast MAC address:
09:00:06:01:FF:EF
* Logical Link Control (LLC) Header: Frames feature an IEEE 802.2 / 802.3 LLC header with Subnetwork Access Protocol (SNAP) Service Access Point (SAP) identifiers set to 0xFE (DSAP = 0xFE, SSAP = 0xFE).

Under normal operation, only the designated hardware time master (e.g., a SICLOCK TC400 or an active WinCC OS Server) broadcasts these frames at regular intervals (typically every 10 seconds). If another controller, CP card, or engineering laptop is accidentally configured as a "Time Master" in HW Config, dual-master collisions occur, causing erratic backward and forward clock jumps across Automation Stations.

Wireshark Capture Setup and Exact Packet Filters

To isolate and locate rogue time transmitters across the industrial network:

Configure Switch Port Mirroring (SPAN):
* Access the web management interface of the Industrial Ethernet switch (e.g., SCALANCE X-200 or X-300).
* Configure Port Mirroring: set the monitor port (destination) to the switch port connected to your engineering laptop, and set the source ports to the Plant Bus uplinks.
Launch Wireshark Capture:
* Open Wireshark and select your physical Ethernet network interface.
* Start packet capture.
Apply Display Filters:
* In the Wireshark filter bar, enter either of the following display filters:
- eth.dst == 09:00:06:01:ff:ef (Filters specifically for Siemens time multicast frames).
- llc[0:2] == 0xfefe (Filters for Siemens SNAP SAP 0xFE frames).
- (eth.dst == 09:00:06:01:ff:ef) && !(eth.src == [SICLOCK_MAC_Address]) (Isolates packets from any device other than your known SICLOCK master).
Analyze Source MAC Addresses and Payload:
* Inspect the packet list. Under normal conditions, exactly one packet appears every 10 seconds originating from the SICLOCK MAC address.
* If packets arrive from a secondary MAC address (e.g., 00:1B:1B:xx:xx:xx), note the MAC address.
* Expand the packet details: inspect the timestamp payload to observe the date and time being broadcast by the competing master.
Trace the Rogue Device:
* In SIMATIC Manager, search your project HW Config for the identified MAC address among S7-400 CP 443-1 cards, CPU 410-5H onboard ports, or CP 1623 adapters.
* Open the offending module in HW Config -> Time Synchronization, uncheck Activate time-of-day synchronization, or change its role from As master to As slave.

Verification

In Wireshark, maintain an active capture filter for 60 seconds. Confirm that time broadcast packets now arrive exclusively from the authorized SICLOCK MAC address.
On the WinCC OS Servers, open C:\Program Files (x86)\Siemens\WinCC\Diagnostics\TimeSync.log. Confirm that warnings such as Time jump detected or Unexpected time master cease completely.
Verify that CPU diagnostic buffers on all AS stations show steady, monotonically increasing clock times without synchronization discrepancies.

Limitations and Operational Precautions

Capturing Layer 2 multicast frames on a non-mirrored switch port may capture only broadcast traffic; configuring a mirrored SPAN port on managed SCALANCE switches is essential for complete bus visibility.
Do not disable time synchronization on an active controller without understanding plant-wide timestamp dependencies, such as alarm Sequence of Events (SOE) logging.
In multi-ring network topologies, ensure that managed switch boundary filters prevent time multicast frames from leaking between independent production units.

Engineer FAQ

Can Wireshark run on an active OS Server?
While technically possible, installing third-party packet capture drivers (WinPcap / Npcap) on active OS Servers can violate strict plant qualification policies. Perform packet capture from an Engineering Station or diagnostic maintenance laptop.
Why did an S7-400 CPU start transmitting time telegrams automatically?
In Step 7 HW Config, inserting certain communication processors (CP 443-1) or copying hardware stations can inadvertently enable the "Send time-of-day synchronization on MPI / Industrial Ethernet" option by default.
What is the difference between SIMATIC mode and NTP mode in Wireshark?
SIMATIC mode frames use Layer 2 Ethernet multicast (09:00:06:01:FF:EF). NTP frames use standard Layer 3/4 UDP packets directed to port 123.

Technical References

SIMATIC PCS 7 Time Synchronization System Manual (A5E41356410-AA).
Siemens Industry Online Support Entry ID 109801081: Diagnosing Time Synchronization on the Plant Bus.
SCALANCE X-300 / X-400 Managed Switch Configuration and Port Mirroring Guide.